Skill UI

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

A comprehensive workflow for performing static and dynamic analysis of malicious PDF documents. It utilizes tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Ideal for triaging phishing attachments, analyzing exploit documents, and building threat signatures in a controlled forensic environment.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

This curriculum covers foundational exploitation techniques essential for binary security analysis. Users will learn to control program execution flow, including overwriting EIP/RIP, constructing ROP chains, implementing ret2libc, and shellcode injection. It provides practical, hands-on exercises on stack overflows and heap manipulation in a controlled Linux environment, establishing the core primitives needed before tackling modern mitigation bypasses.

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.